CCS, Vienna, Austria, October 2016 My Smartphone Knows What You Print: Exploring Smartphone-based Side-channel Attacks Against 3D Printers Chen Song, Feng Lin, Zhongjie Ba, Kui Ren, Chi Zhou, Wenyao Xu

3D Printing Cyber Design 3D Printing Physical Object

3D Printing Principle Design Slicing 3D Printing Add layers of material one at a time to build the solid part from bottom to top Design 3D Printing => Structure-free Slicing 3D Printing

3D Printer Widely accessible and affordable, can use anywhere

3D Printing Market $21 Billion by 2020

3D Printing Application Industrial Product Health-care Tool Aerospace Unit On the right, high tolerance engine parts were printed using a process called “Electron Beam Melting” and finished with traditional machining processes. While not the norm these uses begin to suggest what is possible in medicine and industry. Biomedical Organ Military Device

3D Printing Application Industrial Product Health-care Tool Aerospace Unit On the right, high tolerance engine parts were printed using a process called “Electron Beam Melting” and finished with traditional machining processes. While not the norm these uses begin to suggest what is possible in medicine and industry. Biomedical Organ Military Device

Is 3D printing system safe from attack?

Unobtrusive Side-channel Attack Distance Physical Attack IP Design: G-code File

Side-channel Attack Principle G-code File Printing Trajectory Reconstructed G-code File Predicted Printing Trajectory

Our proposed 3D Printer IP Attack Side-channel Detection Printing Status Prediction IP Reconstruction

Side Channel Emission 3D Printer Physical Structure Emitted Side Channels

Side Channel Detection Professional Devices Magnetometer Smartphone-based Attack Most pervasive daily device Rich on-board sensors Inconspicuous attack Zero launching barrier Prof devices are fairly expensive, hard-to-deploy, and most importantly, too eye-catching (not practical in real attack). Microphone

Side Channel Detection

Category Relationship Primitive Operation Category Relationship Layer Movement Primitive Operation Header Movement Axial Movement Directional Movement

Directional Movement Prediction Primitive Operation Directional Movement Prediction Stepper Motor Working Principle Magnetic Side Channel The structure of the stepper motor: toothed electromagnets and geared-shape rotor. Reverse rotation Reverse side channel

Detected magnetic side channel in two opposite directions Primitive Operation Directional Movement Prediction Detected magnetic side channel in two opposite directions

Category Relationship Primitive Operation Category Relationship Layer Movement Primitive Operation Header Movement Axial Movement Directional Movement

Separate belt-pulley system Different acoustic side channel Primitive Operation Axial Movement Prediction Separate belt-pulley system Different acoustic side channel X Pulley System X Axial Movement Y Axial Movement Y Pulley System

Category Relationship Primitive Operation Category Relationship Layer Movement Primitive Operation Header Movement Axial Movement Directional Movement

Extremely high align speed to save time and avoid stringing Primitive Operation Header Movement Prediction Extremely high align speed to save time and avoid stringing Much higher amplitude in acoustic side channel Fast align Stringing

Category Relationship Primitive Operation Category Relationship Layer Movement Primitive Operation Header Movement Axial Movement Directional Movement

Different acoustic side channel Primitive Operation Layer Movement Prediction Different Transmission System for different accuracy control, frequency and work load Different acoustic side channel Z movement Y movement X movement X/Y belt-pulley Z Lead-screw

Printing Status Prediction Frame size Click on ‘Temporal/Spectral Features’ and jump to feature list.

Printing Status Prediction Click on ‘Printing Status Prediction’ to jump back.

G-code Reconstruction Predicted Primitive Predicted Primitive G-code Protocol Predicted Primitive Click on ‘Algorithm 1’ and jump to the proposed algorithm. (Algorithm 1) Printing Status Set Reconstructed G-code

G-code Reconstruction Click on ‘G-code Reconstruction’ to jump back.

Evaluation (1/5) Primitive Operation Model Accuracy Layer Movement Model Head Movement Model Axial Movement Model Average accuracy=94.77% Y Directional Movement Model X Directional Movement Model

Evaluation (2/5) Reconstruction Performance Geometric Similarity Metric Given the number of points 𝑛, origin points 𝐻𝑋, 𝐻𝑌, reconstructed points 𝐺𝑋, 𝐺𝑌. Mean Tendency Error (MTE) Calculate relative similarity instead of absolute one. Euclidean Dist. > 0 MTE = 0 Certain offset

Evaluation (3/5) Reconstruction Performance Regular shape reconstruction 4-layer shape: MTE = 5.87%

Most bias appear in X Dir. Evaluation (4/5) Reconstruction Performance Complex shape reconstruction 10-layer shape: Average 10 layers Click on ‘Most bias are in X Dir.’ and jump to the explanation. Most bias appear in X Dir. MTE = 9.67%

Evaluation (5/5) Reconstruction Performance Complex shape reconstruction 10-layer shape: Original design Reconstructed shape

Questions How does the frame size affect the model accuracy? Does the smartphone distance affect the attack performance? Is the smartphone orientation required to be fixed?

Model Accuracy and Frame Size Larger frame size improves the model accuracy

Questions How does the frame size affect the model accuracy? Does the smartphone distance affect the attack performance? Is the smartphone orientation required to be fixed?

Reconstruction Performance with Attack Distance Maybe a graph containing printer and smartphone in three distances. Magnetic signal diminishes fast ∝ 𝟏 𝑫𝒊𝒔𝒕. 𝟑

Questions How does the frame size affect the model accuracy? Does the smartphone distance affect the attack performance? Is the smartphone orientation required to be fixed?

Smartphone Orientation Orientation Free Solution Normalized quaternion 𝑞 (Android API) Rotation Matrix 𝑅: Calibration: 𝒎𝒂𝒈𝑫𝒂𝒕 𝒂 ′ =𝑹∗𝒎𝒂𝒈𝑫𝒂𝒕𝒂

Smartphone Orientation Small average variation Carry-on Attack

IP-sensitive, privacy designs are not safe on 3D printer

How can we defend side-channel attack?

Defense Method Metric What is a good defense? Be low cost Does not compromise the printing quality

Extra device, extra cost! Only influence printing time Defense Mechanism Hardware-based Method Hardware Shielding Side Channel Interference Extra device, extra cost! Only influence printing time

Defense Mechanism Software-based Method Dynamic Path Planning Degrade model performance by randomizing params in real time Dummy Task Injection Spoof model by randomly combining operation and configuration (e.g. aligning at printing speed) 3D printing is structure-free => Maintain quality Only influence printing time => Acceptable

Thank you! Q & A

Directional Movement Prediction Based on acoustic side channel This backup slide is to answer why we use mag side channel to predict dir. move in case they ask. The reason is the reverse activation order in stepper motor doesn’t cause much difference in acoustic.

Related Work M. A. Al Faruque, S. R. Chhetri, A. Canedo, and J. Wan. Acoustic side-channel attacks on additive manufacturing systems. In Proceedings of the ACM/IEEE Sixth International Conference on Cyber-Physical Systems. ACM, 2016. This backup slide is to show the difference betw our work and AI’s. We claim that different devices (they used professional one) are used and different side channels are explored.

Y Dir. model is more accurate than X Dir. model Evaluation Primitive Operation Model Accuracy Click on the red part to jump back X Directional Movement Model Y Directional Movement Model Y Dir. model is more accurate than X Dir. model